Build tracker: Hustle

Launch order lives in the plan

Sequencing, design pick per vertical, channel strategy and the 12 week calendar are locked in the roll-out plan. This page is the engineering companion only: what has to be built, in what order, and the gate that says a phase is genuinely finished. If the two ever disagree, the roll-out plan wins.

Stage 0 - before any code matters

These block revenue and nothing else unblocks them. The entity has the longest lead time, so it starts today regardless of what else is happening.

Stage 0 · prerequisites Accounts, entity, domain

Business entity, EIN, bank accountLongest lead time of anything on this page. Stripe cannot pay you without it.
Stripe account activatedNeeds EIN and bank details. Review can take days; describe the business accurately as B2B document auditing.
Cloudflare account and domainHosting, CDN, Turnstile, email routing in one place.
Supabase projectPostgres, magic-link auth, storage, row-level security. Removes the password from the customer's path entirely.
Anthropic API key, with a monthly spend cap setSet the cap before the first batch, not after.
Resend domain verified (SPF, DKIM, DMARC)Start DMARC at p=none for two weeks, read the reports, then move to quarantine.
Errors and omissions insurance quotedOption B and C buyers ask for a certificate.

Build phases

Each phase has one gate. Do not start the next until the gate is genuinely met, and do not build all three website options in parallel.

Phase 1 Schema, auth, upload, extraction

Database schema and migrations applied
Row-level security on every tenant tablePlus an explicit test that a cross-tenant read fails, and a second that a portfolio parent can still see its children.
Magic-link auth working end to endNo passwords anywhere.
Upload path: drag-and-drop, email intake, signed storage URLs
Extraction pipeline with strict JSON schema and per-field confidence
Exceptions queue reachable and monitoredAnything below 0.75 confidence lands here rather than being guessed at.
Duplicate upload creates one document rowThe sha256 uniqueness constraint is what stops a re-uploaded folder being billed twice.

Gate20 real work orders extract correctly, and an illegible page reaches the exceptions queue instead of inventing a value.

Phase 2 Compare, findings, report

Invoice CSV import with a column mapper that remembers the mapping
Price book upload plus trade defaults
Findings emitted and classified across the seven types
Nothing over $500 or under 0.90 confidence is auto-acceptedThis is a deliberate throughput sacrifice. Do not relax it to make the numbers look better.
Every finding shows a crop of the source page with the line highlightedA claim the customer cannot verify is worse than no claim.
Report PDF generates and totals reconcile to accepted findings

GateA report a stranger would pay for, produced without you touching anything except the exceptions queue.

Phase 3 · the milestone Payments and the first website

Stripe products and prices created in test mode
Webhook signature-verified and idempotentInsert the event id first and return 200 on conflict. Stripe retries, and double-provisioning is a real bug.
Provisioning happens from the webhook, never the success URLA redirect is not proof of payment.
Stripe Tax enabled and home state registered
Option A site live on a custom domainPayment lands on the upload screen, not a thank-you page.
Terms, Privacy, DPA, refund policy and delete-my-data path liveBuild the delete path before launch; retrofitting it is painful and someone will ask.
Live keys deployed, one real charge made and refunded

GateOne real paid First Pass from someone you are not related to. This is the only milestone that proves the business exists.

Phase 4 The controller site

Option B site live
Security page published, with certification status stated honestlyIf there is no SOC 2 attestation, say so. A bluff is discovered in one email and costs the deal and the referral.
MSA, DPA, W-9, subprocessor list and security overview downloadable without a form
"What we do not claim" section written, with a measured false-positive rate
ACH invoicing tested end to end at net-15

GateOne booked walkthrough that came from the site rather than from you.

Phase 5 The portfolio site

Option C site live
Billing entity and service entity separable in the data modelIn roll-ups the management company pays and the operating entities consume. Getting this wrong means rebuilding under deadline during your largest contract.
Cohort benchmarking with confidence intervals, and no index below eight peers
Four-step assessment producing a forwardable estimate URL

GateOne completed portfolio assessment forwarded to a partner without you in the room.

Launch day

Nothing ships until every line here is ticked.

What has to be true to collect money

Five things. Any one missing means no revenue, whatever else is finished.

A legal entity with a bank account. Longest lead time. Start it today.
An activated Stripe account. Can take days and may ask for follow-up documents.
A live, signature-verified, idempotent webhook. Without it people are charged and not provisioned, which is the worst possible failure.
A working upload path immediately after payment. Payment without fulfilment is a refund with extra steps.
A report a stranger would pay for again. Everything upstream is machinery. This is the product.